Suricata configuration on Qubes (host / gateway)

[apparatus]

@qubesnewuser01

In that case, my Suricata runs on “host” or “gateway” mode?

It’s in host mode for traffic generated by the sys-suricata qube (e.g. if you ping from this qube’s terminal) and in gateway for the traffic generated by the qubes connected to sys-suricata qube.

@qubesnewuser01

If “gateway” mode, how can I find out the interface names of the two interfaces facing Suricata?

If you want to associate the interface/IP in the sys-suricata qube with the name of the qube that is connected to it and is using this interface then you can try this:

@apparatus

@tannerlambert

associate those nic’s to the client VMs (if that information is only available in dom0 thats ok)

You can create a script in dom0 that will create the associated list “IP address - qube name” and pass it to your custom firewall VM.
You can also add a custom Qubes RPC service that could be called from sys-custom-fw qube script in /rw/config/network-hooks.d on new qube connect/disconnect event to request the dom0 to update the connected qubes associated list:

Qrexec: secure communication across domains | Qubes OS

You can use QubesDB to pass the list to your custom firewall VM, e.g:
In dom0:

qubesdb-write -d sys-custom-fw /connected_qubes_list/10.138.30.88 myqube1

Then read the list in sys-custom-fw:

# get the list of IP addresses of qubes
qubesdb-list /connected_qubes_list/
# read the qube name associated with this IP address
qubesdb-read /connected_qubes_list/10.138.30.88